Rename X509Certificate::VerifyFlags to CertVerifier::VerifyFlags

net/base/cert_verify_proc_openssl.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/base/cert_verify_proc_openssl.h"
 
 #include <openssl/x509v3.h>
 
 #include "base/logging.h"
 #include "base/sha1.h"
 #include "crypto/openssl_util.h"
 #include "net/base/asn1_util.h"
 #include "net/base/cert_status_flags.h"
+#include "net/base/cert_verifier.h"

[wtc, 2012/08/15 22:44:03]

This file doesn't seem to need to include this header because
it isn't using CertVerify::VERIFY_xxx.  See my comment about
the "int flags" argument below.

[Ryan Sleevi, 2012/08/15 23:07:05]

Good catch, removed.

 #include "net/base/cert_verify_result.h"
 #include "net/base/net_errors.h"
 #include "net/base/x509_certificate.h"
 
 #if defined(OS_ANDROID)
 #include "net/android/network_library.h"
 #endif
 
 namespace net {
 
@@ skipping 175 matching lines @@
 #endif  // defined(OS_ANDROID)
 
 }  // namespace
 
 CertVerifyProcOpenSSL::CertVerifyProcOpenSSL() {}
 
 CertVerifyProcOpenSSL::~CertVerifyProcOpenSSL() {}
 
 int CertVerifyProcOpenSSL::VerifyInternal(X509Certificate* cert,
                                           const std::string& hostname,
                                           int flags,

[wtc, 2012/08/15 22:44:03]

I found that this function ignores the |flags| argument.
This seems problematic.

[Ryan Sleevi, 2012/08/15 23:07:05]

The Android function lacks any ability to convert flags to something the JNI
side can use. Thus it's entirely dependent on the trust manager.

Note that, because of this, we also don't support EV on Android.

                                           CRLSet* crl_set,
                                           CertVerifyResult* verify_result) {
   crypto::EnsureOpenSSLInit();
 
   if (!cert->VerifyNameMatch(hostname))
     verify_result->cert_status |= CERT_STATUS_COMMON_NAME_INVALID;
 
   bool verify_attempted = false;
 
 #if defined(OS_ANDROID)
@@ skipping 48 matching lines @@
   // TODO(joth): if the motivations described in
   // http://src.chromium.org/viewvc/chrome?view=rev&revision=80778 become an
   // issue on OpenSSL builds, we will need to embed a hardcoded list of well
   // known root CAs, as per the _mac and _win versions.
   verify_result->is_issued_by_known_root = true;
 
   return OK;
 }
 
 }  // namespace net